Is “pay a small fine and keep on trading” a sufficient penalty for letting a breach happen, impeding an investigation, and hiding the truth?